compliance-operations-office[.]pages[.]dev

Analysis as of July 24, 2026 shows that compliance-operations-office.pages.dev was registered on March 03, 2026 through Cloudflare, Inc. The domain resolves to the IP address 157.240.253.35, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents the page title “Facebook – log in or sign up”, indicating an explicit attempt to impersonate the Facebook brand. VirusTotal records show that eight of ninety‑three security vendors flagged the domain, and it appears on one external blocklist. PhishDestroy has also listed the domain as malicious.

Trust‑score services reflect the malicious nature: Scamadviser assigns a score of 1/100 and Gridinsoft reports 0/100. The domain is served via Cloudflare with HSTS and HTTP/3 enabled, and the TLS certificate is issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 hierarchy. An HTTP request returns a 403 status code, and the current operational status is reported as taken offline. Nameservers melany.ns.cloudflare.com and michael.ns.cloudflare.com are consistent with the registrar.

While the page title confirms brand impersonation, the actual page content has not been captured, leaving the precise phishing kit or credential‑harvesting mechanism unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and update detection signatures to include the observed SSL fingerprint and the specific page title string. Ongoing observation of Cloudflare‑hosted subdomains associated with the same IP range is advisable, as adversaries frequently reuse infrastructure after takedown.